cli-deps.json

{
  "$schema": "./cli-deps.schema.json",
  "$comment": "Pinned versions for every CLI Houston ships or runtime-installs. Bundled (codex, composio) ride inside the .app / .msi under resources/bin. claude-code cannot be bundled (proprietary license) so the runtime installer downloads it on first launch via houston-claude-installer using the URLs + sha256 below. Bumping a version: run `./scripts/bump-cli.sh <name> <version>`, then `./scripts/fetch-cli-deps.sh both` to refresh the staged copies + print the new checksums; pin the printed sha256 back into this file. For Windows, composio is built from source (see `build` block) because upstream does not yet ship a Windows artifact.",
  "claude-code": {
    "version": "2.1.170",
    "bundled": false,
    "binary_name": "claude",
    "license": "PROPRIETARY",
    "install_target": "$HOME/.local/bin/claude",
    "$install_target_comment": "On Windows the runtime installer writes to %LOCALAPPDATA%\\Programs\\claude\\claude.exe instead — the install_target field above is the POSIX-only path; see houston-claude-installer for the Windows resolution path.",
    "urls": {
      "darwin-arm64": "https://storage.googleapis.com/claude-code-dist-86c565f3-f756-42ad-8dfa-d59b1c096819/claude-code-releases/{version}/darwin-arm64/claude",
      "darwin-x64": "https://storage.googleapis.com/claude-code-dist-86c565f3-f756-42ad-8dfa-d59b1c096819/claude-code-releases/{version}/darwin-x64/claude",
      "windows-x64": "https://storage.googleapis.com/claude-code-dist-86c565f3-f756-42ad-8dfa-d59b1c096819/claude-code-releases/{version}/win32-x64/claude.exe",
      "windows-arm64": "https://storage.googleapis.com/claude-code-dist-86c565f3-f756-42ad-8dfa-d59b1c096819/claude-code-releases/{version}/win32-arm64/claude.exe",
      "manifest": "https://storage.googleapis.com/claude-code-dist-86c565f3-f756-42ad-8dfa-d59b1c096819/claude-code-releases/{version}/manifest.json"
    },
    "checksums": {
      "darwin-arm64": "e903646d8b7a31882a80ecd27569a27d8ac57b3708745f349709632c84117fdf",
      "darwin-x64": "914f23a70bbed5d9ae567e3e04b86206ed9971b371bc9baca3f79c8885bfddb4",
      "windows-x64": "193061508fe619abf534b2c9d48151f26971d1d5b8460ad75c0af4be3d3525fb",
      "windows-arm64": "9abd330bcc191aecc877a8ee9da2b448852cfe3bda15e5e4608385ea1d9d1709"
    }
  },
  "codex": {
    "version": "0.137.0",
    "bundled": true,
    "binary_name": "codex",
    "license": "Apache-2.0",
    "ship_layout": "lipo-universal",
    "$ship_layout_comment": "On macOS both arch binaries are downloaded and combined with `lipo -create` into a single Mach-O fat binary at Contents/Resources/bin/codex. On Windows there is no `lipo` equivalent and we ship the OS-native binary directly at resources/bin/codex.exe (per-arch builds; v1 only ships windows-x64).",
    "urls": {
      "darwin-arm64": "https://github.com/openai/codex/releases/download/rust-v{version}/codex-aarch64-apple-darwin.tar.gz",
      "darwin-x64": "https://github.com/openai/codex/releases/download/rust-v{version}/codex-x86_64-apple-darwin.tar.gz",
      "windows-x64": "https://github.com/openai/codex/releases/download/rust-v{version}/codex-x86_64-pc-windows-msvc.exe.zst",
      "windows-arm64": "https://github.com/openai/codex/releases/download/rust-v{version}/codex-aarch64-pc-windows-msvc.exe.zst"
    },
    "checksums": {
      "darwin-arm64": "628d2278b1fa2a467452635f2fd5aaeee98de4a94f2af06031e4790da6844046",
      "darwin-x64": "32206ff8e4edb3422832b24d25a521246e4478b67bab2ec63bee632fdf94b306",
      "windows-x64": "327e93f43d039734353d2ba7feb8ecffd8a0f90c068c5370ac2ae4f80436aa7a",
      "windows-arm64": "1a24ce2d34a2b9e62a22c2a20626a78bab83250f148ce87b73c67b1b0923b1e7"
    }
  },
  "composio": {
    "version": "0.2.24",
    "bundled": true,
    "binary_name": "composio",
    "license": "MIT",
    "ship_layout": "per-arch-dir",
    "$ship_layout_comment": "Composio is a Bun-bundled JS app with arch-specific runtime + sibling .mjs/services files; cannot lipo. Each arch ships at resources/bin/composio-{aarch64|x86_64}/ on every supported OS. The engine resolves at runtime via std::env::consts::ARCH, with a `IsWow64Process2` shim that prefers `composio-aarch64/` when an x64 process is running under Windows-on-ARM emulation (see houston-cli-bundle::host_arch_for_composio). Cross-platform acp-adapters that the resolved arch can never execute are pruned at fetch time to keep the bundle honest in size.",
    "urls": {
      "darwin-arm64": "https://github.com/ComposioHQ/composio/releases/download/@composio/cli@{version}/composio-darwin-aarch64.zip",
      "darwin-x64": "https://github.com/ComposioHQ/composio/releases/download/@composio/cli@{version}/composio-darwin-x64.zip"
    },
    "checksums": {
      "darwin-arm64": "fba0a57788ea50335507b2a38eccc67ebc051272f8393284b239875c4fdff8ef",
      "darwin-x64": "94af160e5bb10be80218dd9377c79a72d5c5ab7e172a65da0607ec4ee4d019c6"
    },
    "$build_comment": "Upstream ComposioHQ/composio does not yet publish Windows artifacts (issue #3057, closed: 'use WSL'). Until that ships, we build composio.exe from a fork at gethouston/composio that adds Windows targets to TARGET_MAP, win32 entries to RUN_CODEX_ACP_BINARY_TARGETS, and a Windows Credential Manager backend in cli-keyring. Both x64 and arm64 builds share the same `houston-windows-support` branch. The arm64 build relies on a bun:ffi fallback patch on that branch, because Bun 1.3.10's windows-arm64 target ships without TinyCC so the FFI keyring store has to downshift to NoStorageAccess at import time. Builds are reproducible: pinned commit SHA, pinned Bun version, pinned bun_target. The `pnpm` package manager + Bun runtime installed on the build host must match the values in the fork's `package.json#packageManager` and `.bun-version` respectively.",
    "build": {
      "windows-x64": {
        "source_repo": "https://github.com/gethouston/composio.git",
        "source_ref": "houston-windows-support",
        "source_sha": "4608b1cd8b75b8533713f2c2ae1424d1fafb3e8a",
        "package_path": "ts/packages/cli",
        "bun_target": "bun-windows-x64-modern",
        "bun_version": "1.3.10",
        "artifact_basename": "composio-windows-x64",
        "$artifact_basename_comment": "Bun appends `.exe` automatically for Windows targets; the staged binary is `dist/binaries/composio-windows-x64.exe` and companions live under `dist/binaries/companions/`."
      },
      "windows-arm64": {
        "source_repo": "https://github.com/gethouston/composio.git",
        "source_ref": "houston-windows-support",
        "source_sha": "4608b1cd8b75b8533713f2c2ae1424d1fafb3e8a",
        "package_path": "ts/packages/cli",
        "bun_target": "bun-windows-arm64",
        "bun_version": "1.3.10",
        "artifact_basename": "composio-windows-arm64",
        "$artifact_basename_comment": "Bun appends `.exe` automatically for Windows targets; the staged binary is `dist/binaries/composio-windows-arm64.exe` and companions live under `dist/binaries/companions/`. The codex-acp companion shipped is the `win32-arm64` build; all other arches are pruned."
      }
    }
  },
  "gemini": {
    "version": "0.42.0",
    "bundled": true,
    "binary_name": "gemini",
    "license": "Apache-2.0",
    "ship_layout": "per-arch-binary",
    "$ship_layout_comment": "Gemini CLI is a Node SEA — single per-arch Mach-O on macOS (arm64 + x86_64). Cannot lipo a Node SEA (the embedded NODE_SEA segment + sentinel fuse are arch-specific Mach-O segments and lipo would corrupt the postject injection). Each arch ships at resources/bin/gemini-{aarch64|x86_64}/gemini on macOS, mirroring the per-arch composio layout. Windows artifact NOT yet shipped — Google publishes only macOS binaries (verified across last 100 releases). When Windows demand justifies the work, build from source via gethouston/gemini-cli fork using upstream's `scripts/build_binary.js` (already has win32 branches, uses postject + Node SEA fuse).",
    "urls": {
      "darwin-arm64": "https://github.com/google-gemini/gemini-cli/releases/download/v{version}/gemini-darwin-arm64-unsigned.zip",
      "darwin-x64": "https://github.com/google-gemini/gemini-cli/releases/download/v{version}/gemini-darwin-x64-unsigned.zip"
    },
    "checksums": {
      "darwin-arm64": "98212f9047fd7c945ed54467d1af86229cb99084648126cc5e207f6678d49199",
      "darwin-x64": "c1c8a72be76b9e3a208f2d676450dda3ccc6ee38a4c011b63ab66d2f946c4a44"
    }
  },
  "git-bash": {
    "version": "2.54.0",
    "bundled": true,
    "binary_name": "bash",
    "license": "GPL-2.0",
    "ship_layout": "sfx-extract-on-first-launch",
    "$comment": "Claude Code on Windows requires Git Bash (bash.exe + msys2 runtime). Without it `claude auth login --claudeai` exits 1 with stderr 'requires git-bash'. Houston bundles PortableGit's self-extracting 7z so the user never sees that error: on first launch the engine reads the bundled .7z.exe, locates the embedded 7z archive (past the PE stub) and extracts it natively via sevenz-rust2 into %LOCALAPPDATA%\\Programs\\Houston\\runtime\\git-bash-{x86_64|aarch64}\\, then sets CLAUDE_CODE_GIT_BASH_PATH on every claude.exe spawn. The SFX is never executed — its GUI module pops a progress dialog we can't hide and used to gate engine startup on a CPU-bound subprocess. Per-arch because the host's native arch matters for shell perf (and because PortableGit-arm64 dropped in git-for-windows 2.40+). We ship the archive rather than the 410 MB extracted tree because MSI compression of binary content is much worse than 7z's. First-launch cost: ~5-10s, runs in the background so it never blocks engine boot. See houston-engine-core::git_bash for the in-process decoder.",
    "urls": {
      "windows-x64": "https://github.com/git-for-windows/git/releases/download/v{version}.windows.1/PortableGit-{version}-64-bit.7z.exe",
      "windows-arm64": "https://github.com/git-for-windows/git/releases/download/v{version}.windows.1/PortableGit-{version}-arm64.7z.exe"
    },
    "checksums": {
      "windows-x64": "bea006a6cc69673f27b1647e84ab3a68e912fbc175ab6320c5987e012897f311",
      "windows-arm64": "f8e92cd3359fcbb96998cfd606a536ccc6dbfb23c04e12b29042f9ba45b6b0c7"
    }
  }
}